CVE-2018-3749

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-37509.8The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when th CVE-2018-37519.8The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object whe CVE-2018-37529.8The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when CVE-2018-37539.8The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when CVE-2018-37548.8Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of user CVE-2018-37556.1XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element u CVE-2018-37567.5Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transact CVE-2018-37579.8Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.CVE-2018-37588.8Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.CVE-2018-37593.7private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the sock CVE-2018-37607.5There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specia CVE-2018-37618.1Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allow